# Ruleset Update Summary - 2026/09/23 - v11296

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-23-v11296/3462>\
**Category:** Ruleset Updates\
**Created:** [September 23, 2026, 8:12pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-23-v11296/3462 "2026-09-23T20:12:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [September 23, 2026, 8:12pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-23-v11296/3462/1 "2026-09-23T20:12:51Z")

</div>

## Summary:

6 new OPEN, 12 new PRO (6 + 6)

* * *

## Added rules:

### Open:

- 2072159 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (sehneider .com) (exploit\_kit.rules)
- 2072160 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (sehneider .com) (exploit\_kit.rules)
- 2072161 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (caneclothesdriverhen .pw) (malware.rules)
- 2072162 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (caneclothesdriverhen .pw) in TLS SNI (malware.rules)
- 2072163 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finprom .my) (malware.rules)
- 2072164 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (finprom .my) in TLS SNI (malware.rules)

### Pro:

- 2868698 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (foundation .forum) (malware.rules)
- 2868699 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (app-river .icu) (malware.rules)
- 2868700 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (xyz-code .biz) (malware.rules)
- 2868701 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (foundation .forum) (malware.rules)
- 2868702 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (app-river .icu) (malware.rules)
- 2868703 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (xyz-code .biz) (malware.rules)